> You can redirect ssh failure messages to a specific log > file, separate from all others That's exactly the point. Now you redirect ssh failure messages to

> You can redirect ssh failure messages to a specific log > file, separate from all others That's exactly the point. Now you redirect ssh failure messages to a specific log file (with all the garbage and automated attacks), and you'll very soon start to ignore it. And then your overall security is reduced, simply because you aren't paying attention. Or, you can spend time combing through hundreds of invalid messages, trying to separate the wheat from the chaff. Either in one or multiple separate files, it doesn't really matter. Anyway, not trying to convince anybody here. I respect the opinion that some may prefer to leave everything as the default. For me, I just vehemently disagree with OP's point that using a non-std port doesn't have concrete benefits and/or reduce the security. To me it's exactly the opposite. At least if you know what (and why) you're doing.